Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update rimraf dependency #846

Open
1 task done
brittag opened this issue Jul 12, 2024 · 1 comment
Open
1 task done

Update rimraf dependency #846

brittag opened this issue Jul 12, 2024 · 1 comment

Comments

@brittag
Copy link

brittag commented Jul 12, 2024

Is there an existing issue for this?

  • I have searched existing issues, it hasn't been reported yet

Use case description

My team is required to run Snyk vulnerability scanning on our dependencies, and Snyk highlights the following series of dependencies:

[email protected][email protected][email protected][email protected]

Inflight (https://www.npmjs.com/package/inflight) brings up a vulnerability finding in Snyk (https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116) and is also deprecated:

This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.

Proposed solution (optional)

There are newer versions of rimraf (https://github.com/isaacs/rimraf) available that require newer versions of glob, which don't have the transitive dependency on inflight.

Note that to remove inflight entirely, this related issue would also need to be addressed: #495

I understand that this may be a lower priority task, just noting it for consideration. Thank you!

@aribasadme
Copy link

Following. I have the same issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants